XSS in Yahoo Yui
CVE-2013-6780
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.024 (82.5th percentile) — read the EPSS interpretation.
Affected products
- Yahoo Yui — versions 2.5.0, 2.5.1, 2.5.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (mailing-list, x_refsource_MLIST)
- cve@mitre.org (x_refsource_CONFIRM, Exploit, Vendor Advisory)